REMARKS 

In the Office Action dated June 25, 2008, claims 8-10 were rejected under 35 U.S.C. § 
101 because "the language of the claim raises a question as to whether the claim is directed to 
merely an abstract idea that is not tied to a technological art, environment or machine . . . under 
35 U.S.C. 101." In addition, claims 1, 2, and 4 were rejected under 35 U.S.C. § 102(e), as 
anticipated by U.S. Patent Publication No. 2003/0061541 to Kaler et al. ("Kaler"); claims 3, 5-8, 
11, and 14-18 were rejected under 35 U.S.C. § 103(a) as being unpatentable over Kaler as 
applied to claim 1, and further in view of U.S. Patent No. 6,826,697 to Moran ("Moran"); claims 
9 and 12 were rejected under U.S.C. § 103(a) as being unpatentable over Kaler as applied to 
claims 8 and 1 1, and further in view of Moran and U.S. Patent Publication No. 20020099806 to 
Balsamo et al. ("Balsamo"); and claims 10, 13, 19, and 20 were rejected under U.S.C. § 103(a) 
as being unpatentable over Kaler as applied to claims 8, 1 1 and 18, and further in view of Moran 
and U.S. Patent No. 6,965,634 to Clark ("Clark"). Applicants respectfully traverse the rejections 
for the reasons set forth hereinbelow. 

A. Claims 8-10 Recite Statutory Subject Matter 

In rejecting claims 8-10 under 35 U.S.C. § 101, the Examiner asserted that "the language 
of the claim raises a question as to whether the claim is directed merely to an abstract idea that is 
not tied to a technological art, environment or machine which would result in a practice (sic, 
practical) appUcation producing a concrete, useful, and tangible result" and rejects the claims as 
being "drawn to a form of signal" or "form of energy." See, Final Office Action , p. 4. In 
support of this rejection, the Examiner referred to Applicants' description at page 5, paragraph 
23 of the application as showing that a "medium" that includes a "signal" or "carrier wave," and 
concludes therefrom that "the claims fail to place the invention squarely within one statutory 
class of invention." In response. Applicants respectfully submit that they are not able to locate 
any reference in paragraph 23 to a "medium" that includes a "signal" or "carrier wave" as 
asserted by the Examiner. If the Examiner would be willing to identify the specific passage in 
paragraph 23 that describes Applicants' supposed intent concerning the meaning of the term 
"medium," Applicants would be willing to amend the specification to remove the language of 
concern. 

Regarding the statutory subject matter rejection, when discussing patentable subject 
matter for computer-related inventions, the MPEP states that: 
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The claimed invention as a whole must accomplish a practical result. . . . The purpose of 
this requirement is to limit patent protection to inventions that possess a certain level of 
"real world" value, as opposed to subject matter that represents nothing more than an idea 
or concepts, or is simply a starting point for future investigation or research. . . 
Accordingly, a complete disclosure should contain some indication of the practical 
application for the claimed invention, i.e., why the applicant believes the claimed 
invention is useful. 

See, MPEP § 2106A (citations omitted). Additionally, the Federal Circuit has addressed the 
issue of whether computer software is patentable subject matter in a number of decisions. For 
example, the Federal Circuit in In re Alappat set forth the view that certain types of mathematical 
subject matter, standing alone, represent nothing more than abstract ideas until reduced to some 
type of practical application, and thus that subject matter is not, in and of itself, entitled to patent 
protection. For determining whether a claim is statutory subject matter, the focus must be on the 
claim as a whole. It is not necessary to determine whether a claim contains, as merely a part of 
the whole, any mathematical subject matter that standing alone would not be entitled to patent 
protection. In In re Alappat. the four claimed means elements ftinctioned to transform one set of 
data to another tiirough what may be viewed as a series of mathematical calculations. But that 
alone does not justify a holding that the claim as a whole is directed to non-statutory subject 
matter. The claim is not so abstract and sweeping that it would wholly preempt the use of any 
apparatus employing the combination of mathematical calculations recited therein. In rc 
Alappat . 33 F.3d 1526, 31 USPQ2d 1545 (Fed. Cir. 1994). 

The Federal Circuit also addressed the issue of patentable subject matter in State Street 
Bank & Trust Co. V. Signature Fin Group Inc. (State Street s In State Street , the Federal Circuit 
sets forth: 

Today we hold that the transformation of data, representing discrete dollar amounts, by a 
machine through a series of mathematical calculations into a final price, constitutes a 
practical application of a mathematical algorithm, formula, or calculation, because if 
produces a 'a useful, concrete and tangible result' -a final share price momentarily fixed 
for recording and reporting purposes and even accepted and relied upon by regulatory 
authorities and in subsequent trades. 

The question of whether a claim encompasses statutory subject matter should not focus 
on which of the four categories of subject matter a claim is directed to -process, machine, 
manufacture, or composition of matter-but rather on the essential characteristics of the 
subject matter, in particular, its practical utility. Section 101 specifies that statutory 
subject matter must also satisfy the other 'conditions and requirements' of Title 35, 
including novelty, nonobviousness, and adequacy of disclosure and notice. See In re 
Warmerdam . 33 F.3d 1354, 1359, 31 USPQ2d 1754, 1757-58 (Fed. Cir. 1994). For 
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purpose of our analysis, as noted above, claim 1 is directed to a machine programmed 
with the Hub and Spoke software and admittedly produces a 'useful, concrete, and 
tangible result.' Alappat . 33 F.3d at 1544, 31 USPQ2d at 1557. This renders it statutory 
subject matter, even if the useful result is expressed in numbers, such as price, profit, 
percentage, cost, or loss. 

State Street Bank & Trust Co. V. Signature Fin Group Inc.. 149 F. 3d 1368, 47 USPQ2d 1596 

(Fed. Cir. 1998). 

The Federal Circuit also addressed the issue of whether software embodied on a 
computer readable media is statutory subject matter in In re Beauregard . The issue in In re 
Beauregard related to a Board rejection of computer program product claims on the grounds of a 
printer matter objection. During the pendency of the appeal, the PTO commissioner issued an 
order that computer programs embodied in a tangible medium are patentable subject matter. 
Based upon the PTO commissioner's order, the Federal circuit vacated and remanded the appeal. 
(See e.g., In re Beauregard , 53 F. 3d 1583, 35 USPQ2d 1383 (Fed. Cir. 1995.) 

Nothwithstanding the foregoing, and in the absence of knowing what specific language 
from paragraph 23 is being cited by the Examiner, and solely to expedite prosecution and 
without agreeing with the stated reasoning. Applicants have amended claim 8 to recited a "one 
computer recordable storage medium" to comply with a requirement of form set forth in the 
previous Office Action. This type of amendment has been suggested and permitted by 
Examiners in other cases where the "form of energy" rejection was raised. Accordingly, 
Applicants submit that the amendment is permitted under 35 CFR § 1.1 16(b)(1). 

B. Claims 1-20 Are Not Anticipated or Obvious 

In response to the various rejections of claims 1-20 as being anticipated or obvious over 
Kaler, alone or in combination with Moran, Balsamo, and/or Clark, Applicants respectfully 
request reconsideration and withdrawal of the rejections because the cited art fails to disclose 
Appplicants' session-based scheme for grouping and processing log file entries using a memory 
window to select a subset of the log file records for identifying complete session records that 
may be analyzed or parsed, and for otherwise identifying incomplete session records for 
subsequent processing. 

In particular, claims 1-7 recite a method for "grouping log file entries bv session " 
wherein log file entries in memory are each processed "to identify entries in the subset of log file 
entries that belong to a complete client session ." thereby allowing " grouping [of| entries in the 
subset that belong to a complete client session ." Claim 1 (emphasis added). In rejecting the 
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claims, the Examiner cites Kaler, paragraphs 139, 246, 27, 283, 232, 19, 172 and 188. See, 
Office Action , pp. 7-8. With all due respect. Applicants submit that the cited passages no where 
disclose or suggest the claim requirements for grouping log files by session, as readily seen fi-om 

the cited passages set forth below: 

Kaler, T1139 ("Some important pre-defined event fields are the Machine, Process, Entity 
(referred to as "Component" in Table 1 below and in the APIs ), Instance (referred to as 
"Session" in Table 1 below and in the APIs), and Handle fields, both for the Source as 
well as for the Target. Their use will be explained in greater detail below.") 

Kaler, T[246 ("The set of APIs includes an interface that enables the operating system to 
read any one or more of several fields in the application. These fields include arguments, 
causality i.d., correlation i.d., dynamic event data, exception, retum value, security i.d., 
source component, source handle, source machine, source process, source process name, 
source session, source thread, target component, target handle, target machine, target 
process, target process name, target session, and target thread.") 

Kaler, ^[27 ("Correlation makes use of the source and target information specified in the 
event data. When insufficient information is present, additional heuristics can be used to 
extrapolate the event flow. This includes time-ordering, COM causality information, and 
event handles.") 

Kaler, Tf283 ("Behind this visual depiction of the application model, the VSA maintains a 
log of all of the events that have been collected.") 

Kaler, ^{232 ("Event sources are required to pre-register which events they can emit when 
they are installed, and this information is transmitted at startup fi"om the LEC to the 
central machine. By selecting the "Collect" tab 256, the user can quickly select the 
desired information to analyze. More complex queries can be generated by creating 
groups of selections using the "OR" tab 258. As the user makes selections, a textual 
representation of the query, appearing in text window 260, is dynamically generated in 
synchronism with the graphical depiction in windows 250, 252, and 254, so the user can 
verify his or her selection, and understand its behavior. Finally, the user can specify very 
sophisticated filter queries by entering the filter directly as text in text window 260.") 

Kaler, \\9 ("There also exist known tools called profilers. These look at a single 
executing software application and try to understand its performance. They do this either 
by monitoring the program (in a similar way to PerfMon software), or else they hook into 
the program they are monitoring and generate "events" each time a program 
subcomponent (fimction) commences or completes. Profilers t3q)ically have a massive 
impact on the performance and behavior of an application, because they are intrusive, and 
they typically require special compiler support. Their data is so detailed that it is 
normally impractical to use them, particularly in a distributed computing environment 
such as the one described above.") 

Kaler, *\\12 ("FIG. 5 illustrates a transition between two entities, EO and El, within the 
hardware and operating environment. A "transition" occurs when one entity (e.g. a 
program, process, or object) tums execution over to another to complete a specific task. 
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In FIG. 5 the illustrated transition comprises four events, a Call event, an Enter event, a 
Leave event, and a Return event.") 

Kaler, T[188 ("A Handle is a way of referencing an individual instance of an entity. 
Handles are used by a calling entity to call (reference) a particular instance of an entity. 
Thus, the calling entity knows what Handle it is calling, and the entity being called (the 
target) knows its own Handle. When this process is applied for both the source and the 
target (each of which will have its own Handle), it is possible to collect together four 
events into the standard group of CALL/ENTER/LEAVE/RETURN. It is important to 
realize that any entity instance can have many different Handles that refer to it. For 
example, when A and C are both talking to B, A might use the Handle "BAT" to refer to 
B, where C might use the Handle "BALL" to refer to B.") 

While the word "session" appears in the Kaler description, there is no teaching or 

suggestion of grouping log file entries by session by identifying entries in a subset of logfile 
entries that belong to complete session, nor of grouping entries in the subset that belong to a 
complete session. To assert otherwise is an exercise in imagination. Accordingly, Applicants 
submit that a prima facie case of anticipation or obviousness has not been established for claims 
1-7. 

In similar fashion, the cited art fails to teach or suggest the requirements in claims 8-10 of 
an computer software which "allocate[s], for each identified user session, an index to identify all 
records in the ring buffer that are associated with the identified user session and to identify all 
start or end records" and then " process[es] the index to group all records in the ring buffer 
belonging to a complete user session , to output the grouped records for further analysis." Claim 
8 (emphasis added). After admitting that these requirements fi"om claim 8 are missing fi-om 
Kaler, the Examiner cites selected passages fi-om Moran to meet the claim requirements. See, 
Final Office Action , pp. 14-15. With all due respect. Applicants submit that the cited passages 
no where disclose or suggest the claim requirements for grouping records in the ring buffer 
belonging to a complete user session, as readily seen from the cited Moran passages set forth 
below: 

Moran, col. 18, lines 41-45 ("iii) Session identifier. This is an index to a data structure 
specifying the conditions for this particular invocation of this sensor. This data structure 
includes the host that the sensor collected data from and the options specified for this 
invocation.") 

Moran, col. 23, lines 55-57 ("lastlog: The sensor that processes lastlog makes two passes 
over the file. The file is an array of struct lastlog data structures, indexed by the User ID. 
In the first pass, it reports the data from all the non-null entries. The second pass 
examines the raw file, looking for disk blocks that are allocated, but null. This condition 
arises only if the file has been copied or updated by a program other than login.") 
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Moran, col. 24, lines 1-4 ("The extent to which the inventive system can identify the 
specific user whose records were tampered with depends upon the size of the struct 
lastlog records and on the pattern of allocation of User IDs on the host.") 

Moran, col. 19, lines 61-65 ("The stereotypical pattern is that when a valid usemame- 
password pair is entered, the login process writes a record to the utmp and wtmp files and 
updates the lastlog file. The utmp file tracks who is currently logged in, and the wtmp file 
provides a historical record, including both completed login sessions and active 

sessions.") 

Moran, col. 10, lines 43-46 ("For example, some tools allow a system administrator to be 
alerted whenever an entry matching any of the patterns he has specified is written to a 
designated log file, thereby substantially reducing his need to manually check the log 
file.") 

While Moran refers to a "session identifier," there is no teaching or suggestion of 
allocating indexes for each identified user session to identify all records in the ring buffer that are 
associated with the identified user session , nor of processing the indexes to group all records in 
the ring buffer belonging to a complete user session . Accordingly, Applicants submit that a 
prima facie case of obviousness has not been established for claims 8-10. 

As for claims 1 1-17, the cited art fails to teach or suggest the requirements of a system 

for session-based processing of log files which includes "a processing engine to process a subset 

of the plurality of server request entries to group the server request entries bv session using the 

session identifier in each server request entry." Claim 1 1 (emphasis added). After admitting that 

these requirements from claim 1 1 are missing from Kaler, the Examiner cites selected passages 

from Moran to meet the claim requirements. See, Final Office Action , pp. 16-17. With all due 

respect. Applicants submit that the cited passages no where disclose or suggest the claim 

requirements for session-based processing of log files , as readily seen from the cited Moran 

passages set forth below: 

Moran, col. 18, lines 41-45 ("iii) Session identifier. This is an index to a data structure 
specifying the conditions for this particular invocation of this sensor. This data structure 
includes the host that the sensor collected data from and the options specified for this 
invocation.") 

Moran, col. 10, lines 12-16 ("The data collection modules are designed to be hghtweight 
and relatively simple, and different data sources are handled by different modules. These 
modules extract the data and add identifying information for the fields, simplifying the 
task for the analysis engine, which may have to deal with variants of the information 
from different platforms..") 

Moran, col. 19, lines 61-65 ("The stereotypical pattern is that when a valid usemame- 
password pair is entered, the login process writes a record to the utmp and wtmp files and 



-11- 



updates the lastlog file. The utmp file tracks who is currently logged in, and the wtmp file 
provides a historical record, including both completed login sessions and active 

sessions.") 

Moran, col. 10, lines 43-46 ("For example, some tools allow a system administrator to be 
alerted whenever an entry matching any of the patterns he has specified is written to a 
designated log file, thereby substantially reducing his need to manually check the log 
file.") 

Again, Moran reference to a "session identifier" does not amount to a teaching or 
suggestion of a system for session-based processing of log files which includes a processing 
engine to process a subset of the plurality of server request entries to group the server request 
entries bv session using the session identifier in each server request entry. Accordingly, 
Applicants submit that a prima facie case of obviousness has not been established for claims 11- 
17. 

Finally, the cited art fails to teach or suggest the requirements in claims 18-20 of "system 
for parsing web site logs one session at a time " by processing a subset of network session data 
" to group said network session data by session " and "generating a first output file containing 
network session data grouped by session ." Claim 18 (emphasis added). In rejecting these 
claims, the Examiner cites Kaler, paragraph 246 to meet the "means for processing. . element 
and Kaler, page 16 (top left, C interface codes) to meet the "means for generating. . ." element. 
See, Office Action , pp. 20-21 . With all due respect. Applicants submit that the cited passages no 
where disclose or suggest the claim requirements for parsing log files by session. In particular, 
neither Kaler, T|246 (which describes an interface API "that enables the operating system to read 
any one or more of several fields in the application. These fields include arguments, causality 
i.d., correlation i.d., dynamic event data, exception, return value, security i.d., source component, 
source handle, source machine, source process, source process name, source session, source 
thread, target component, target handle, target machine, target process, target process name, 
target session, and target thread."), nor the "APIs for Generating Events (C Interface)" at page 
16, teach or suggest of a system for parsing web site logs one session at a time by using a means 
for processing a subset of network session data to group said network session data by session and 
a means for generating a first output file containing network session data grouped by session . 
Accordingly, Applicants submit that a prima facie case of obviousness has not been established 
for claims 18-20. 
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CONCLUSION 

In view of the amendments and remarks set forth herein, Applicants respectfully submit 
that all pending claims are in condition for allowance. Accordingly, Applicants request that the 
rejections of claims 1-20 be withdrawn and that a Notice of Allowance be issued. If there are 
any remaining issues that might be resolved through a telephonic interview. Applicant's 
undersigned representative would welcome an opportunity to discuss such issues with the 
Examiner. 
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